Process Mining: Using System Data to See How Your Business Processes Really Run

Many companies have drawn process maps: how orders are approved, how goods are shipped, how invoices are issued, how payments are collected. But a process map usually describes how things “should be done,” not how they are “actually done.” In real operations, orders get revised again and again, approvals get skipped, and documents sit at a single step for days. The value of process mining lies in reconstructing the true shape of a process from data that already exists in your business systems, rather than relying on memory and impressions.

So what exactly is process mining, which companies is it suited to, and how do you get started? In this article we cover the basic concept of process mining and how it differs from traditional process mapping, what the “event logs” it relies on are, the problems it can uncover in the order-to-cash process, where the market stands today, and how SMEs can start in a lightweight way. We also discuss an issue that is often overlooked: how to keep process mining from turning into employee monitoring.

What is process mining, and how does it differ from traditional process mapping?

Process mining is a family of methods for discovering, monitoring and improving real processes from the event data held in business systems. The question it answers is not “what should the process look like?” but “what does the process actually look like?”

The academic foundations of the field trace back to computer scientist Wil van der Aalst. He is currently a professor at RWTH Aachen University in Germany, where he leads the Process and Data Science group, and he is often called the “godfather of process mining”; his research, begun in the late 1990s, went on to give rise to a wide range of commercial and open-source process mining tools (source). In 2011, the IEEE Task Force on Process Mining published the Process Mining Manifesto, which defines process mining as techniques, tools and methods that extract knowledge from event logs in order to discover, monitor and improve “real processes (i.e., not assumed processes)” (source).

The manifesto distinguishes three basic types of process mining, which remain the simplest framework for understanding the technology:

• Discovery. Without assuming any model up front, a process map is drawn directly from the data. For example, after importing a year of sales order data, you automatically get every path orders actually took from creation to payment.
• Conformance. An existing standard process is compared with actual data to find where reality deviates. For example, if policy requires purchases above a certain amount to be approved by the general manager, the data can show how many orders bypassed that step.
• Enhancement. Time, frequency, cost and other information are overlaid on the process map to show where things slow down or get stuck. For example, marking the average waiting time at each step reveals the most time-consuming stretch.

Process mining is not meant to replace traditional process mapping. Traditional methods rely on interviews, workshops and on-site observation, and are good at understanding “why things are done this way”; process mining relies on system data, and is good at answering “what actually happened, and how often.” The table below compares the main differences:

The two work best together: use data to find where the problems are, then interviews to understand why they exist. Data tells you “what is wrong”; people tell you “why it is wrong.”

How does process mining work? It starts with the event log

The raw material of process mining is the event log. As long as your system records “which case, what was done, and when,” you have the foundation for process mining.

A basic event log typically contains three columns:

• Case ID: identifies a single business object, such as a sales order number, purchase order number or work order number.
• Activity: the steps that object goes through, such as “Create order,” “Credit approval,” “Ship,” “Invoice” and “Receive payment.”
• Timestamp: when the step took place.

Strictly speaking, the Process Mining Manifesto only requires that each record can be linked to a case and an activity; timestamps, resources and similar details are optional additional information (source). In practical business analysis, however, without timestamps you cannot calculate waiting times or identify bottlenecks, so all three columns should be in place.

Taking the order-to-cash process as an example, an event log extracted from an ERP might look like this:

The order numbers and dates here are illustrative. A few rows on their own reveal little, but when the records for tens of thousands of orders are put together, the tool links them by order number, merges identical paths, and draws a process map annotated with frequencies and durations. Even these few rows expose two common types of problem: SO-1001 was invoiced 5 days after shipping, and SO-1002 was shipped first and credit-approved afterwards, in reverse order.

In the order-to-cash process, process mining most often uncovers four kinds of problem:

• Rework. The same order has its price, quantity or delivery date changed repeatedly, or an invoice is voided and reissued after being sent. For example, if a large share of orders are modified two or more times before shipping, it often means information at the quoting or order-entry stage is inaccurate.
• Workarounds. The actual path departs from what policy requires. For example, credit approval is skipped or completed after the fact, or orders from key accounts bypass the system and are shipped directly. Such cases are not necessarily violations, but you need to confirm whether proper authorization exists.
• Bottlenecks. A large number of cases pile up at one step, and processing takes noticeably longer than elsewhere. For example, every order over its credit limit has to wait for approval from a single finance manager, and a long queue forms at every month-end.
• Waiting time. Nothing happens between two steps; the document is simply “waiting.” For example, the goods have been shipped, but the invoice cannot be issued until the sales rep is back in the office to complete the paperwork. Every day invoicing slips, cash collection slips too.

Truly valuable findings are usually not sweeping conclusions such as “the process is a mess,” but specific facts such as “which type of order, at which step, waits how many extra days on average.” The same approach applies to the procure-to-pay process: for example, finding cases where the invoice arrives before the purchase order is raised, or the step where invoices are repeatedly sent back because the three documents (purchase order, goods receipt and invoice) do not match.

How mature is the process mining market?

Process mining has grown from academic research into a software market in its own right, and it is still growing quickly. For SMEs, though, getting clear on the problem you want to solve matters more than choosing a platform.

Research firm Gartner regularly publishes a Magic Quadrant evaluation of process mining platforms. According to industry publication Process Excellence Network’s coverage of Gartner’s Magic Quadrant for Process Mining Platforms, released in April 2025, global process mining software revenue reached US$871.6 million in 2023, growing 39.5%; spending grew by more than 30% in 2024; and Gartner expects the market to exceed US$2 billion by 2028, a compound annual growth rate of about 18% from 2023 to 2028 (source). The report evaluated 16 vendors. Note that these figures measure software vendor revenue and mainly reflect purchasing by large and mid-sized enterprises; they do not indicate adoption rates among SMEs.

The same article also summarizes several of Gartner’s observations about the market, which help clarify where the technology is heading:

• Core capabilities have become standardized. Gartner lists four mandatory features for process mining platforms: event log extraction, process model and analysis, comparative analysis, and process model enhancement.
• Adoption drivers are shifting. Beyond cost reduction, efficiency and digital transformation, companies introducing AI and generative AI also need to understand first how their underlying processes actually run.
• Analysis is getting closer to how business really works. One direction worth watching is object-centric process mining. Traditional methods require each record to belong to a single case, but in real operations one order may be split across several shipments and consolidated into a single invoice; object-centric approaches can track the relationships among orders, delivery notes and invoices at the same time.

These trends show that process mining is moving from one-off “process diagnostics” toward continuous operational monitoring. For companies that have not yet started, there is no need to aim for a platform from day one; validating the value with one process and one dataset is the safer path.

How can SMEs start in a lightweight way? A step-by-step guide

Process mining for SMEs does not necessarily require buying an expensive platform or building a data team. Most ERP and business systems already record enough data; the key is shaping it into an event log. For example, the sales order table holds the creation time, approval records hold the approval time, and delivery notes, invoices and payment receipts each carry their own dates. Join these records by order number and you have a usable event log.

There are also several options for analysis tools: beyond commercial platforms, there are open-source tools such as ProM and PM4Py (source); when data volumes are small, pivot analysis in a spreadsheet can answer quite a few basic questions, such as “how many days, on average, pass between shipping and invoicing?”

Step 1: Choose one process and ask one specific question. Don’t start by trying to “mine every process.” Pick a process with a clear pain point and centralized data, such as order-to-cash or procure-to-pay, and write the question as a single sentence, for example: “Why is our average collection period two weeks longer than our contractual payment terms?”

Step 2: Find where the data lives. Working with IT staff or the system administrator, list the documents and tables involved in the process: which steps are recorded in the system, in which table, and whether the time fields are reliable. This step will also expose data gaps, for example an approval that is completed on WeChat and leaves no record in the system.

Step 3: Export the data and shape it into an event log. Start by exporting 3 to 6 months of data and organizing it into three columns (case ID, activity and timestamp), adding attributes such as handling department, customer type and amount where needed. Standardize activity names and remove test data and obvious errors. Data preparation is often the most time-consuming part of the whole project, and that is normal.

Step 4: Map the actual process, main paths first, then exceptions. Once the tool has generated the process map, first look at what share the most common paths account for, then examine the exception paths. Focus on rework, workarounds, backlogs and long waits, and compare by customer, product or department.

Step 5: Interpret the results with frontline staff. Take the findings back to the people who run the process and find out the reasons behind them. For example, if the data shows many orders having their prices changed after shipping, it may be because sales negotiated discounts outside the system. A process map without business interpretation can easily lead to the wrong conclusions.

Step 6: Pick one or two improvements and set a baseline and targets. Based on impact and ease of change, choose the one or two improvements most worth making, such as simplifying credit approval for small orders or requiring invoices to be issued within 24 hours of shipping. Record the pre-change metric as a baseline, for example the average invoicing delay in days.

Step 7: Re-run regularly to turn a one-off diagnosis into continuous monitoring. After the improvements go live, re-analyze with fresh data every month or quarter to confirm whether the metrics have improved and whether any new workarounds have appeared. Once the method is running smoothly, consider extending it to a second process or bringing in a dedicated platform.

How do you keep process mining from becoming employee monitoring?

Process mining analyzes business processes, but event logs often carry information about who handled each step. Used carelessly, a process improvement project can easily be seen by employees as “the company using data to watch me,” costing you their trust and cooperation.

Employees’ concerns are not unfounded. When the UK Information Commissioner’s Office (ICO) published guidance on workplace monitoring in October 2023, it cited a survey of 1,012 UK adults: around 70% of respondents considered monitoring at work intrusive, and 57% said they would feel uncomfortable taking a job if they knew they would be monitored (source). The survey concerned workplace monitoring in general and the sample was drawn from the UK, but it illustrates how sensitive employees generally are to being observed through data.

The ICO’s guidance requires employers, before monitoring, to tell workers in plain language about the nature, extent and reasons for the monitoring, to define a clear purpose and choose the least intrusive means, and to keep only data relevant to that purpose; where monitoring is likely to pose a high risk to workers’ rights, a data protection impact assessment should be carried out first. The Process Mining Manifesto likewise states that privacy and security must be addressed when recording event data, and that the people involved should know which events are recorded and how they will be used (source).

Drawing on these principles, companies can act on several fronts:

• Analyze processes, not individuals. State clearly that the project’s goal is process improvement, aggregate results by step, department and customer type, avoid individual rankings, and do not feed the analysis directly into performance reviews.
• Data minimization and de-identification. Export only the fields needed to answer the question; if handler information is not essential, delete it or replace it with codes for role or department.
• Communicate in advance and involve employees. Before the project starts, explain what will and will not be analyzed and how long the data will be kept, and invite frontline staff to help interpret the results.
• Comply with local regulations. Any processing of employees’ personal information must comply with the personal data protection laws where the company operates; involve legal or compliance staff where necessary.

For example, if the analysis finds that one step takes especially long, the right question is “are the workload and rules at this step reasonable?” and not “who is the slowest?” Keep the focus on the process, and employees will be willing to share the real reasons behind it.

Frequently asked questions about process mining

How does process mining relate to RPA (robotic process automation)? They solve different problems. Process mining shows you the process and pinpoints problems; RPA automates repetitive tasks. The safer sequence is to use process mining first to confirm which steps are worth optimizing or automating, so you avoid automating a process that was flawed to begin with.

Our ERP is old and the data is incomplete. Can we still do it? Usually, yes. As long as key documents have numbers and dates, you can build a basic event log. Data gaps are a finding in themselves: approvals that leave no trace in the system, for example, are exactly what needs improving.

How long does a process mining project take? It depends on how scattered the data is and how hard it is to prepare. If the data sits in one system and the question is well defined, a first round of analysis can often be completed fairly quickly; when data is spread across several systems, preparation will take up most of the time.

Does process mining require exporting employees’ names? In most cases, no. When analyzing process issues, aggregating by role or department is sufficient. Retain handler information only when truly necessary, inform employees in advance, and restrict who can view it.

References

• Process Mining Manifesto, IEEE Task Force on Process Mining, 2011
• Wil van der Aalst’s homepage, personal academic homepage of the RWTH Aachen University professor, accessed November 2026
• 5 highlights from Gartner's 2025 Magic Quadrant for Process Mining Platforms, Process Excellence Network, April 2025
• ICO publishes guidance to ensure lawful monitoring in the workplace, UK Information Commissioner’s Office (ICO), October 2023